Privacy Notice - University of York
Clinical Evaluation of Magnetic Resonance Imaging in Coronary Heart Disease-2 (CE-MARC2)
Outline
This privacy notice is to provide you with details of the ways in which personal data received from the University of Leeds is processed by the University of York, including how it is gathered, used, stored and shared. Contact details are provided in case of any queries regarding the privacy notice, or in case of any concerns with the current management of your data.
Who is responsible for the data? For the purposes of this privacy notice, the University of York is a Data Controller as defined in the EU General Data Protection Regulation (the ‘GDPR’) and the U.K. Data Protection Act 2018 (together the ‘Data Protection Laws’).
The University of York (‘York’) are registered with the Information Commissioner’s Office and its entry can be found at the following address: https://ico.org.uk/ESDWebPages/Entry/Z4855807. Registration number: Z4855807.
Who is conducting the research? The research is conducted by researchers at the University of York, in collaboration with the University of Leeds. The University of Leeds have their own privacy statements in relation to personal data which you can find on their webpage.
What are the objectives of the research and the purpose of using your data? York is part of a collaborative research team for the CE-MARC2 study. Information about the study and its clinical results can be found at the following address: https://jamanetwork.com/journals/jama/fullarticle/ 2546718.
York’s role is to carry out detailed analysis of the costs and outcomes of alternative diagnostic strategies in patients with suspected coronary heart disease (CHD). The data York requires for the analysis includes information from the CE-MARC 2 randomised clinical trial.
What data do we require? York have the following data on trial participants: trial ID, date of birth, information regarding the health of the individual (e.g. living status, pre-test likelihood of CHD, and health-related quality of life data), patient characteristics (including age, sex and ethnicity) and the care participants received (including details of hospital stays and all diagnostic procedures and treatments administered in the trial, such as date of admission, procedure, and discharge, reason for admission, diagnosis, all medications and procedures, and hospital code(s)).
Any details that could identify an individual were removed prior to the receipt of the data. York has collected the minimum amount of data necessary for the study.
What is our legal basis for processing your data?
Under the Data Protection Laws, York has to identify a legal basis for processing personal data and, where appropriate, an additional condition for processing special category data.
In line with York’s charter which states that it advances learning and knowledge by teaching and research, York processes personal data for research purposes under Article 6 (1) (e) of the GDPR: Processing is necessary for the performance of a task carried out in the public interest.
Special category data is processed under Article 9 (2) (j): Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes.
How do we use your data?
York will process data for the purposes outlined in this privacy notice, which is to enable York to make a detailed analysis of the costs and outcomes of alternative diagnostic strategies in patients with suspected CHD.
Who do we share your data with?
Permitted employees of York working on the research project will use the data. Information will be treated as confidential and shared on a need-to-know basis only. Data will not be shared with any third parties. York may need to disclose the data to a regulator or to otherwise comply with the law.
How will we keep your data secure? The Centre for Health Economics and the University of York have implemented appropriate technical and organisational measures to protect personal data. Access to information is restricted on a need-to- know basis and the University is committed to the principle of data protection by design and default. The data security arrangements at the Centre for Health Economics and the University form part of the Data Sharing Agreement with NHS Digital, they are documented and audited periodically.
Will we transfer your data internationally? No. Data will not leave the UK.
Will we identify you in any research outputs? No. The data we hold does not allow us to identify individuals
How long will we keep your data? York will destroy the data upon publication of the project outcomes or three years following receipt of the data, whichever the sooner. At the end of this time, the data will be destroyed safely and in accordance with the Data Protection Laws.
What rights do you have in relation to your data? Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you have withdrawn from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible. For further information see: https://www.york.ac.uk/records- management/generaldataprotectionregulation/individualsrights/ or http://www.leeds.ac.uk/secretariat/data_protection.html Questions or concerns If you have any questions about this privacy notice or concerns about how your data is being processed at the University of York, please contact the University of York project team: [email protected] in the first instance and concerns can also be directed to the University of York’s Data Protection Officer: [email protected]
If you have any concerns about the way your personal data is being processed you may also contact the University of Leeds Data Protection Officer using any of the following details: Email: [email protected]; General postal address: University of Leeds, Leeds LS2 9JT, UK; Postal address for data protection issues: University of Leeds, Room 11.72 EC Stoner Building, Leeds, LS2 9JT; Telephone number: +44 (0)113 243 1751.
Right to complain If you are unhappy with the way in which your personal data has been handled, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office, see www.ico.org.uk/concerns